Privacy Policy

This policy describes how Staso AI, at Sector 16/17, Hisar, Haryana, India, processes information when you use staso.ai, the dashboard, APIs, SDKs, and developer tools. Questions and requests can be sent to [email protected].

1. Account and workspace information

When you sign in, Staso processes your name, email address, Google or GitHub authentication information, organization and workspace membership, roles, permissions, session records, and API-key metadata.

2. Service data and capture controls

Staso processes the trace, span, provider, tool, Guard, and usage data that your application sends. You can independently suppress request content, system prompts, tool schemas, tool arguments, and output before SDK serialization. Operational fields such as model, status, latency, token counts, tool names, and identifiers may remain when a content category is suppressed. Suppression is not redaction.

Retained content is sanitized for recognized protected values before Redis and again before ClickHouse. This does not discover every possible personal value or secret in customer content. See the Security and data handling page for the implemented boundary.

3. Analytics and browser storage

Staso sends explicit product and page events to PostHog's EU endpoint. DOM autocapture, automatic pageview capture, and session recording are disabled. Staso removes query strings and external URL values from PostHog URL properties and redacts invite and shared-link tokens in URL paths.

The site and dashboard use browser storage for analytics state, the selected organization and workspace, filters, display preferences, and temporary widget state. Durable access and refresh credentials remain in HttpOnly cookies rather than JavaScript-readable storage.

4. Network and security data

Staso may process IP addresses, User-Agent strings, request metadata, and approximate location information for sessions, rate limits, abuse prevention, security alerts, and support requests. Backend enrichment may use ip-api.com.

5. Billing data

If billing is offered to your organization, Staso processes selected capacity, backend quotes, invoice or payment references, amounts, currency, service periods, payment status, and cancellation, refund, and UPI AutoPay mandate status records. Razorpay checkout, when assigned and enabled, handles payment-instrument entry. Staso receives the provider identifiers and transaction facts needed to verify billing. Manual bank billing uses verified payment evidence and opaque invoice or payment references.

6. How information is used

• Provide, secure, and maintain the service.
• Display the traces, spans, usage, and Guard data you send.
• Manage accounts, organizations, workspaces, permissions, and API keys.
• Process support, security, and billing requests.
• Measure explicit product usage and diagnose failures.

7. Sharing and processors

Information may be available to authorized members of your organization. Staso also uses service providers for infrastructure, storage, Google or GitHub authentication, PostHog analytics, Resend email, ip-api.com enrichment, and Razorpay billing when that rail is assigned and enabled. Information may also be disclosed when required by law or during a business transaction.

8. Retention and deletion

Trace retention follows your plan's limits, shown on the pricing page. Other account, security, support, analytics, and billing records follow their operational or provider lifecycles. Internal retention and operator-requested tenant deletion cover documented stores, but Staso does not promise a public account export, self-service account closure, or universal deletion timeline. Contact [email protected] with a data request, including access, correction, or deletion. We may need to verify your identity and authority over the account. Some records may need to be retained for legal, billing, or security purposes.

9. Your responsibilities

You control the code paths you instrument and the data your application sends. Review provider, tool, and Guard fields before using Staso with sensitive data.

10. Children

The service is not directed to individuals under 18.

11. Changes

We may update this policy and will change the date above when we do.

12. Contact

Questions about this policy can be sent to [email protected]. Further contact details are on our Contact Us page.